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Criminal Infrastructure Known as Avalanche 

Assistant Attorney General Leslie R. Caldwell of the Justice Department’s Criminal Division, Acting U.S. 
Attorney Soo C. Song of the Western District of Pennsylvania and Special Agent in Charge of the Federal 
Bureau of Investigation’s Pittsburgh Division Robert Johnson issued the following statement today: 

“November 30 began the start of a multi-national operation to dismantle a complex, criminal network of 
worldwide computer servers known as Avalanche. This network hosted more than two dozen of the 
world’s most pernicious types of malware and several money laundering campaigns. 

“The operation is being conducted by the United States Attorney’s Office for the Western District of 
Pennsylvania, the FBI - Pittsburgh Division, and the Computer Crime and Intellectual Property Section of 
the United States Department of Justice, in close cooperation with the Public Prosecutor’s Office Verden 
and the Luneburg Police of Germany, Europol and Eurojust, located in The Hague, Netherlands, and 
investigators and prosecutors from more than 40 countries. 

“The operation involves an unprecedented and ongoing effort to seize, block and sinkhole more than 
800,000 malicious domains associated with the Avalanche network. 

“The operation involves arrests and searches in five countries. More than 50 Avalanche servers 
worldwide were taken offline. 

“The Avalanche network, which has been operating since at least 2010, is estimated to involve hundreds 
of thousands of infected computers worldwide. The monetary losses associated with malware attacks 
conducted over the Avalanche network are estimated to be in the hundreds of millions of dollars 
worldwide, although exact calculations are difficult due to the high number of malware families present 
on the network. 

“Additional information on the dismantling of Avalanche and several Western Pennsylvania victims of 
Avalanche-based malware attacks will be provided early next week.” 



